Abstract: A multiple redundant computer system includes three primary processor modules (PPM) and three redundant processor modules (RPM) operating synchronously. Primary and redundant processor modules are dissimilar in hardware and software for decreasing the probability of a common cause system failure. Each primary and redundant processor module receives input data from associated primary and redundant input modules respectively, executes control program and transfers output data to an output module. The output module produces a system output as the result of 2-out-of-3 voting among output data generated by PPMs. In response to PPMs hard failures, the output module still produces the system output as the result of 2-out-of-3 voting among output data generated by any combination of the PPM and the RPM. As such, the system is able to operate properly even though five-out-of six processor modules have failed.

Abstract: A hybrid multiple redundant computer system having redundant input modules, central processor modules, and output modules operating in parallel, where output circuits within each output module are connected to associated microcontrollers, such that, a first output circuit is connected to a first and a third microcontroller, a second output circuit is connected to a second and the first microcontroller, and a third output circuit is connected to the third and the second microcontroller; each output module further comprising watchdog controllers for detecting faults within the microcontrollers or central processing modules, where the watchdog controllers produce alarm signals upon detection of a failure within these components; the output circuits further including means for providing a 2-of-3 vote among data produced by three central processor modules if alarm signals are not activated and for reverting to a 2-of-2 and 1-of-1 vote in the presence of one and two faulty components respectively.

Abstract: A hybrid multiple redundant computer system (10) having at least three parallel operating processing units (12) including input module (14), central processor module (16), and output module (50) in each processing unit is disclosed. The central processor module (16) is connected to the associated input module (14) and connected to primary and secondary output circuits (18, 20) located in the associated output module (50) and in the neighboring output module (50) respectively. Each processing unit (12) further includes a watchdog controller (30) that monitors the associated central processor module (16) and transfers an alarm signal (44) to each output module (50) in the event that a central processor module (16) fails.